Troubleshooting Tip: FortiClient SAML User Verification with Entra ID is failed with 'expecting attribute "userPrincipalName"' message

After configuring SAML user verification with Entra ID, the endpoint is getting 'The SAML configuration you are using to authenticate is expecting the userPrincipalName attribute "userPrincipalName" error message:

This is due to there being non-default Entra ID settings in the Azure tenant. 

To resolve this:

1. In the Entra ID application, go to Single sign-on.
2. Under Attributes & Claims, add a claim for userPrincipalName:

Select Add a new claim:

• In the Name field, type userPrincipalName.
• In the Source attribute field, select user.userPrincipalName.

3. Save the configuration. On the endpoint FortiClient, enter the Invitation Code with SAML verification, the verification will be successful.